@jshookmcp/jshook 0.2.6 → 0.2.7

package/dist/PEAnalyzer-CK0xe0Fs.mjs

@@ -0,0 +1,385 @@
+import { t as logger } from "./logger-BmWzC2lM.mjs";
+import { a as GetModuleFileNameEx, b as openProcessForMemory, d as ReadProcessMemory, i as GetModuleBaseName, n as EnumProcessModules, s as GetModuleInformation, t as CloseHandle } from "./Win32API-Bc0QnQsN.mjs";
+import { promises } from "node:fs";
+//#region src/native/PEAnalyzer.types.ts
+/** PE section characteristic flags */
+const IMAGE_SCN = {
+	CNT_CODE: 32,
+	CNT_INITIALIZED_DATA: 64,
+	CNT_UNINITIALIZED_DATA: 128,
+	MEM_EXECUTE: 536870912,
+	MEM_READ: 1073741824,
+	MEM_WRITE: 2147483648
+};
+/** Data directory indices */
+const IMAGE_DIRECTORY_ENTRY = {
+	EXPORT: 0,
+	IMPORT: 1,
+	RESOURCE: 2,
+	EXCEPTION: 3,
+	IAT: 12,
+	DELAY_IMPORT: 13
+};
+//#endregion
+//#region src/native/PEAnalyzer.ts
+/**
+* PE Analyzer Engine.
+*
+* Parses PE headers from process memory using ReadProcessMemory.
+* Provides import/export table resolution, inline hook detection,
+* and section anomaly analysis.
+*
+* @module PEAnalyzer
+*/
+const MZ_MAGIC = 23117;
+const PE_SIGNATURE = 17744;
+const PE32PLUS_MAGIC = 523;
+const SECTION_HEADER_SIZE = 40;
+const IMPORT_DESCRIPTOR_SIZE = 20;
+const COMPARE_BYTES = 16;
+var PEAnalyzer = class {
+	/**
+	* Parse PE headers from a module's base address in process memory.
+	*/
+	async parseHeaders(pid, moduleBase) {
+		const base = BigInt(moduleBase);
+		const hProcess = openProcessForMemory(pid);
+		try {
+			const dosData = ReadProcessMemory(hProcess, base, 64);
+			const e_magic = dosData.readUInt16LE(0);
+			if (e_magic !== MZ_MAGIC) throw new Error(`Invalid DOS header: expected 0x5A4D, got 0x${e_magic.toString(16)}`);
+			const e_lfanew = dosData.readUInt32LE(60);
+			const ntData = ReadProcessMemory(hProcess, base + BigInt(e_lfanew), 264);
+			const ntSignature = ntData.readUInt32LE(0);
+			if (ntSignature !== PE_SIGNATURE) throw new Error(`Invalid PE signature: expected 0x4550, got 0x${ntSignature.toString(16)}`);
+			const machine = ntData.readUInt16LE(4);
+			const numberOfSections = ntData.readUInt16LE(6);
+			const timeDateStamp = ntData.readUInt32LE(8);
+			const characteristics = ntData.readUInt16LE(22);
+			const magic = ntData.readUInt16LE(24);
+			const isPE32Plus = magic === PE32PLUS_MAGIC;
+			let imageBase;
+			let entryPoint;
+			let sizeOfImage;
+			let numberOfRvaAndSizes;
+			if (isPE32Plus) {
+				entryPoint = ntData.readUInt32LE(40);
+				imageBase = ntData.readBigUInt64LE(48);
+				sizeOfImage = ntData.readUInt32LE(80);
+				numberOfRvaAndSizes = ntData.readUInt32LE(132);
+			} else {
+				entryPoint = ntData.readUInt32LE(40);
+				imageBase = BigInt(ntData.readUInt32LE(52));
+				sizeOfImage = ntData.readUInt32LE(80);
+				numberOfRvaAndSizes = ntData.readUInt32LE(116);
+			}
+			return {
+				dosHeader: {
+					e_magic,
+					e_lfanew
+				},
+				ntSignature,
+				fileHeader: {
+					machine,
+					numberOfSections,
+					timeDateStamp,
+					characteristics
+				},
+				optionalHeader: {
+					magic,
+					imageBase: `0x${imageBase.toString(16)}`,
+					entryPoint: `0x${entryPoint.toString(16)}`,
+					sizeOfImage,
+					numberOfRvaAndSizes
+				}
+			};
+		} finally {
+			CloseHandle(hProcess);
+		}
+	}
+	/**
+	* List all PE sections with permissions.
+	*/
+	async listSections(pid, moduleBase) {
+		const base = BigInt(moduleBase);
+		const hProcess = openProcessForMemory(pid);
+		try {
+			const headers = await this._readCoreHeaders(hProcess, base);
+			const sections = [];
+			for (let i = 0; i < headers.numSections; i++) {
+				const off = headers.firstSectionOffset + i * SECTION_HEADER_SIZE;
+				const secData = ReadProcessMemory(hProcess, base + BigInt(off), SECTION_HEADER_SIZE);
+				const nameEnd = secData.indexOf(0);
+				const name = secData.subarray(0, nameEnd > 0 && nameEnd <= 8 ? nameEnd : 8).toString("ascii");
+				const virtualSize = secData.readUInt32LE(8);
+				const virtualAddress = secData.readUInt32LE(12);
+				const rawSize = secData.readUInt32LE(16);
+				const chars = secData.readUInt32LE(36);
+				sections.push({
+					name,
+					virtualAddress: `0x${virtualAddress.toString(16)}`,
+					virtualSize,
+					rawSize,
+					characteristics: chars,
+					isExecutable: (chars & IMAGE_SCN.MEM_EXECUTE) !== 0,
+					isWritable: (chars & IMAGE_SCN.MEM_WRITE) !== 0,
+					isReadable: (chars & IMAGE_SCN.MEM_READ) !== 0
+				});
+			}
+			return sections;
+		} finally {
+			CloseHandle(hProcess);
+		}
+	}
+	/**
+	* Parse import table.
+	*/
+	async parseImports(pid, moduleBase) {
+		const base = BigInt(moduleBase);
+		const hProcess = openProcessForMemory(pid);
+		try {
+			const headers = await this._readCoreHeaders(hProcess, base);
+			const importRva = headers.dataDirectories[IMAGE_DIRECTORY_ENTRY.IMPORT];
+			if (!importRva || importRva.rva === 0) return [];
+			const imports = [];
+			let descOffset = importRva.rva;
+			for (let i = 0; i < 500; i++) {
+				const desc = ReadProcessMemory(hProcess, base + BigInt(descOffset), IMPORT_DESCRIPTOR_SIZE);
+				const nameRva = desc.readUInt32LE(12);
+				if (nameRva === 0) break;
+				const nameData = ReadProcessMemory(hProcess, base + BigInt(nameRva), 256);
+				const nullIdx = nameData.indexOf(0);
+				const dllName = nameData.subarray(0, nullIdx > 0 ? nullIdx : 256).toString("ascii");
+				const originalFirstThunkRva = desc.readUInt32LE(0) || desc.readUInt32LE(16);
+				const functions = this._readThunkArray(hProcess, base, originalFirstThunkRva, headers.isPE32Plus);
+				imports.push({
+					dllName,
+					functions
+				});
+				descOffset += IMPORT_DESCRIPTOR_SIZE;
+			}
+			return imports;
+		} finally {
+			CloseHandle(hProcess);
+		}
+	}
+	/**
+	* Parse export table.
+	*/
+	async parseExports(pid, moduleBase) {
+		const base = BigInt(moduleBase);
+		const hProcess = openProcessForMemory(pid);
+		try {
+			const exportDir = (await this._readCoreHeaders(hProcess, base)).dataDirectories[IMAGE_DIRECTORY_ENTRY.EXPORT];
+			if (!exportDir || exportDir.rva === 0) return [];
+			const expData = ReadProcessMemory(hProcess, base + BigInt(exportDir.rva), 40);
+			const numberOfNames = expData.readUInt32LE(24);
+			const addressOfFunctionsRva = expData.readUInt32LE(28);
+			const addressOfNamesRva = expData.readUInt32LE(32);
+			const addressOfNameOrdinalsRva = expData.readUInt32LE(36);
+			const ordinalBase = expData.readUInt32LE(16);
+			const exports = [];
+			const namesBuf = ReadProcessMemory(hProcess, base + BigInt(addressOfNamesRva), numberOfNames * 4);
+			const ordsBuf = ReadProcessMemory(hProcess, base + BigInt(addressOfNameOrdinalsRva), numberOfNames * 2);
+			for (let i = 0; i < Math.min(numberOfNames, 2e3); i++) {
+				const nameRva = namesBuf.readUInt32LE(i * 4);
+				const ordIndex = ordsBuf.readUInt16LE(i * 2);
+				const nameBuf = ReadProcessMemory(hProcess, base + BigInt(nameRva), 256);
+				const nullIdx = nameBuf.indexOf(0);
+				const name = nameBuf.subarray(0, nullIdx > 0 ? nullIdx : 256).toString("ascii");
+				const funcRva = ReadProcessMemory(hProcess, base + BigInt(addressOfFunctionsRva + ordIndex * 4), 4).readUInt32LE(0);
+				let forwardedTo = null;
+				if (funcRva >= exportDir.rva && funcRva < exportDir.rva + exportDir.size) {
+					const fwdBuf = ReadProcessMemory(hProcess, base + BigInt(funcRva), 256);
+					const fwdEnd = fwdBuf.indexOf(0);
+					forwardedTo = fwdBuf.subarray(0, fwdEnd > 0 ? fwdEnd : 256).toString("ascii");
+				}
+				exports.push({
+					name,
+					ordinal: ordinalBase + ordIndex,
+					rva: `0x${funcRva.toString(16)}`,
+					forwardedTo
+				});
+			}
+			return exports;
+		} finally {
+			CloseHandle(hProcess);
+		}
+	}
+	/**
+	* Detect inline hooks by comparing first bytes of exported functions (disk vs memory).
+	*/
+	async detectInlineHooks(pid, moduleName) {
+		const hProcess = openProcessForMemory(pid);
+		const detections = [];
+		try {
+			const modules = this._enumerateModulesInternal(hProcess);
+			const targets = moduleName ? modules.filter((m) => m.name.toLowerCase().includes(moduleName.toLowerCase())) : modules;
+			for (const mod of targets) try {
+				const diskData = await promises.readFile(mod.path);
+				const exports = await this.parseExports(pid, mod.base);
+				for (const exp of exports) {
+					const funcRva = parseInt(exp.rva, 16);
+					if (funcRva === 0 || exp.forwardedTo) continue;
+					const memBytes = ReadProcessMemory(hProcess, BigInt(mod.base) + BigInt(funcRva), COMPARE_BYTES);
+					const diskOffset = this._rvaToFileOffset(diskData, funcRva);
+					if (diskOffset < 0 || diskOffset + COMPARE_BYTES > diskData.length) continue;
+					const diskBytes = diskData.subarray(diskOffset, diskOffset + COMPARE_BYTES);
+					if (!memBytes.equals(diskBytes)) {
+						const hookType = this._classifyHook(memBytes);
+						const jumpTarget = this._decodeJumpTarget(memBytes, BigInt(mod.base) + BigInt(funcRva));
+						detections.push({
+							address: `0x${(BigInt(mod.base) + BigInt(funcRva)).toString(16)}`,
+							moduleName: mod.name,
+							functionName: exp.name,
+							originalBytes: Array.from(diskBytes),
+							currentBytes: Array.from(memBytes),
+							hookType,
+							jumpTarget
+						});
+					}
+				}
+			} catch (e) {
+				logger.debug(`Hook check skipped for ${mod.name}: ${e}`);
+			}
+		} finally {
+			CloseHandle(hProcess);
+		}
+		return detections;
+	}
+	/**
+	* Analyze sections for anomalies (RWX, writable code, etc.).
+	*/
+	async analyzeSections(pid, moduleBase) {
+		const sections = await this.listSections(pid, moduleBase);
+		const anomalies = [];
+		for (const sec of sections) if (sec.isReadable && sec.isWritable && sec.isExecutable) anomalies.push({
+			sectionName: sec.name,
+			anomalyType: "rwx",
+			severity: "high",
+			details: `Section ${sec.name} has Read+Write+Execute permissions — unusual and potentially malicious`
+		});
+		else if (sec.isWritable && sec.isExecutable) anomalies.push({
+			sectionName: sec.name,
+			anomalyType: "writable_code",
+			severity: "high",
+			details: `Section ${sec.name} is writable and executable — code may be self-modifying or packed`
+		});
+		else if (sec.isExecutable && !sec.name.startsWith(".text") && !sec.name.startsWith(".code") && (sec.characteristics & IMAGE_SCN.CNT_INITIALIZED_DATA) !== 0) anomalies.push({
+			sectionName: sec.name,
+			anomalyType: "executable_data",
+			severity: "medium",
+			details: `Data section ${sec.name} has execute permission`
+		});
+		return anomalies;
+	}
+	async _readCoreHeaders(hProcess, base) {
+		const e_lfanew = ReadProcessMemory(hProcess, base, 64).readUInt32LE(60);
+		const ntData = ReadProcessMemory(hProcess, base + BigInt(e_lfanew), 264);
+		const numSections = ntData.readUInt16LE(6);
+		const sizeOfOptionalHeader = ntData.readUInt16LE(20);
+		const isPE32Plus = ntData.readUInt16LE(24) === PE32PLUS_MAGIC;
+		const numberOfRvaAndSizes = isPE32Plus ? ntData.readUInt32LE(132) : ntData.readUInt32LE(116);
+		const dataDirectoriesOffset = isPE32Plus ? 136 : 120;
+		const dataDirectories = [];
+		for (let i = 0; i < Math.min(numberOfRvaAndSizes, 16); i++) {
+			const off = dataDirectoriesOffset + i * 8;
+			if (off + 8 <= ntData.length) dataDirectories.push({
+				rva: ntData.readUInt32LE(off),
+				size: ntData.readUInt32LE(off + 4)
+			});
+		}
+		return {
+			numSections,
+			isPE32Plus,
+			firstSectionOffset: e_lfanew + 4 + 20 + sizeOfOptionalHeader,
+			dataDirectories
+		};
+	}
+	_readThunkArray(hProcess, base, thunkRva, isPE32Plus) {
+		const thunkSize = isPE32Plus ? 8 : 4;
+		const functions = [];
+		const IMAGE_ORDINAL_FLAG = isPE32Plus ? 9223372036854775808n : 2147483648n;
+		for (let i = 0; i < 2e3; i++) {
+			const thunkData = ReadProcessMemory(hProcess, base + BigInt(thunkRva + i * thunkSize), thunkSize);
+			const thunkValue = isPE32Plus ? thunkData.readBigUInt64LE(0) : BigInt(thunkData.readUInt32LE(0));
+			if (thunkValue === 0n) break;
+			if ((thunkValue & IMAGE_ORDINAL_FLAG) !== 0n) functions.push({
+				name: `Ordinal#${Number(thunkValue & 65535n)}`,
+				ordinal: Number(thunkValue & 65535n),
+				hint: 0,
+				thunkRva: `0x${(thunkRva + i * thunkSize).toString(16)}`
+			});
+			else {
+				const hintNameRva = Number(thunkValue);
+				const hintNameData = ReadProcessMemory(hProcess, base + BigInt(hintNameRva), 258);
+				const hint = hintNameData.readUInt16LE(0);
+				const nullIdx = hintNameData.indexOf(0, 2);
+				const name = hintNameData.subarray(2, nullIdx > 2 ? nullIdx : 258).toString("ascii");
+				functions.push({
+					name,
+					ordinal: 0,
+					hint,
+					thunkRva: `0x${(thunkRva + i * thunkSize).toString(16)}`
+				});
+			}
+		}
+		return functions;
+	}
+	_enumerateModulesInternal(hProcess) {
+		const modules = [];
+		try {
+			const { modules: modHandles, count } = EnumProcessModules(hProcess);
+			for (let i = 0; i < count; i++) {
+				const hMod = modHandles[i];
+				const name = GetModuleBaseName(hProcess, hMod);
+				const info = GetModuleInformation(hProcess, hMod);
+				const modulePath = GetModuleFileNameEx(hProcess, hMod) ?? name;
+				if (info.success) modules.push({
+					name,
+					base: `0x${info.info.lpBaseOfDll.toString(16)}`,
+					path: modulePath,
+					size: info.info.SizeOfImage
+				});
+			}
+		} catch (e) {
+			logger.debug(`Module enumeration failed: ${e}`);
+		}
+		return modules;
+	}
+	_rvaToFileOffset(peData, rva) {
+		const e_lfanew = peData.readUInt32LE(60);
+		const numSections = peData.readUInt16LE(e_lfanew + 6);
+		const sizeOfOptionalHeader = peData.readUInt16LE(e_lfanew + 20);
+		const secStart = e_lfanew + 24 + sizeOfOptionalHeader;
+		for (let i = 0; i < numSections; i++) {
+			const off = secStart + i * 40;
+			if (off + 40 > peData.length) break;
+			const virtualAddr = peData.readUInt32LE(off + 12);
+			const virtualSize = peData.readUInt32LE(off + 8);
+			const rawOffset = peData.readUInt32LE(off + 20);
+			if (rva >= virtualAddr && rva < virtualAddr + virtualSize) return rawOffset + (rva - virtualAddr);
+		}
+		return -1;
+	}
+	_classifyHook(memBytes) {
+		if (memBytes[0] === 233) return "jmp_rel32";
+		if (memBytes[0] === 255 && memBytes[1] === 37) return "jmp_abs64";
+		if (memBytes[0] === 104 && memBytes[5] === 195) return "push_ret";
+		return "unknown";
+	}
+	_decodeJumpTarget(memBytes, funcAddr) {
+		if (memBytes[0] === 233) {
+			const rel32 = memBytes.readInt32LE(1);
+			return `0x${(funcAddr + 5n + BigInt(rel32)).toString(16)}`;
+		}
+		if (memBytes[0] === 255 && memBytes[1] === 37) {
+			if (memBytes.length >= 14) return `0x${memBytes.readBigUInt64LE(6).toString(16)}`;
+		}
+		if (memBytes[0] === 104) return `0x${memBytes.readUInt32LE(1).toString(16)}`;
+		return "0x0";
+	}
+};
+const peAnalyzer = new PEAnalyzer();
+//#endregion
+export { PEAnalyzer, peAnalyzer };

package/dist/PointerChainEngine-Cd73qu5b.mjs

@@ -0,0 +1,322 @@
+import { Dt as POINTER_CHAIN_SCAN_CHUNK_SIZE, Et as POINTER_CHAIN_MAX_RESULTS, Tt as POINTER_CHAIN_MAX_OFFSET, wt as POINTER_CHAIN_MAX_DEPTH } from "./constants-CCvsN80K.mjs";
+import { t as nativeMemoryManager } from "./NativeMemoryManager.impl-CB6gJ0NM.mjs";
+import { t as createPlatformProvider } from "./factory-CibqTNC8.mjs";
+import { n as parseAddress, t as formatAddress } from "./formatAddress-ChCSIRWT.mjs";
+import { randomUUID } from "node:crypto";
+//#region src/native/PointerChainEngine.ts
+/**
+* Pointer Chain Engine — multi-level BFS pointer scanning.
+*
+* Finds stable pointer chains: [base_module+offset] → [+off1] → [+off2] → ... → target
+* Supports chain validation, resolution, and persistence.
+*
+* Uses PlatformMemoryAPI for cross-platform memory operations.
+*
+* @module PointerChainEngine
+*/
+var PointerChainEngine = class {
+	_provider = null;
+	get provider() {
+		if (!this._provider) this._provider = createPlatformProvider();
+		return this._provider;
+	}
+	/**
+	* Multi-level BFS pointer scan.
+	*
+	* Algorithm:
+	* Level 0: Find pointers P where *P ∈ [target - maxOffset, target + maxOffset]
+	* Level 1: Find pointers Q where *Q ∈ [P - maxOffset, P + maxOffset] for each P
+	* ... repeat up to maxDepth
+	* Construct chains backward from target to base.
+	*/
+	async scan(pid, targetAddress, options) {
+		const start = performance.now();
+		const maxDepth = Math.min(options?.maxDepth ?? 4, POINTER_CHAIN_MAX_DEPTH);
+		const maxOffset = options?.maxOffset ?? POINTER_CHAIN_MAX_OFFSET;
+		const maxResults = options?.maxResults ?? POINTER_CHAIN_MAX_RESULTS;
+		const alignment = options?.alignment ?? 8;
+		const staticOnly = options?.staticOnly ?? false;
+		const targetAddr = parseAddress(targetAddress);
+		const handle = this.provider.openProcess(pid, false);
+		try {
+			const modules = await this.getModuleMap(pid);
+			const levelResults = [];
+			let currentTargets = new Set([targetAddr]);
+			for (let depth = 0; depth < maxDepth; depth++) {
+				if (currentTargets.size === 0) break;
+				const matches = this.scanLevel(handle, currentTargets, maxOffset, alignment, options?.modules ? { modules: options.modules } : void 0);
+				if (matches.length === 0) break;
+				levelResults.push(matches);
+				currentTargets = /* @__PURE__ */ new Set();
+				for (const m of matches) {
+					currentTargets.add(m.pointerAddress);
+					if (currentTargets.size > 5e4) break;
+				}
+			}
+			const chains = this.buildChains(levelResults, targetAddr, modules, maxResults, staticOnly);
+			const elapsed = `${(performance.now() - start).toFixed(1)}ms`;
+			return {
+				pid,
+				targetAddress: formatAddress(targetAddr),
+				chains,
+				totalFound: chains.length,
+				maxDepth,
+				elapsed
+			};
+		} finally {
+			this.provider.closeProcess(handle);
+		}
+	}
+	/**
+	* Validate a pointer chain by re-dereferencing each link.
+	*/
+	async validateChain(pid, chain) {
+		const handle = this.provider.openProcess(pid, false);
+		try {
+			let currentAddr = parseAddress(chain.baseAddress);
+			for (let i = 0; i < chain.links.length; i++) {
+				const link = chain.links[i];
+				let ptrValue;
+				try {
+					ptrValue = this.provider.readMemory(handle, currentAddr, 8).data.readBigUInt64LE(0);
+				} catch {
+					return {
+						chainId: chain.id,
+						isValid: false,
+						resolvedAddress: null,
+						expectedAddress: chain.targetAddress,
+						brokenAt: i
+					};
+				}
+				currentAddr = ptrValue + BigInt(link.offset);
+			}
+			const resolvedStr = formatAddress(currentAddr);
+			const expectedAddr = parseAddress(chain.targetAddress);
+			const isValid = currentAddr === expectedAddr;
+			return {
+				chainId: chain.id,
+				isValid,
+				resolvedAddress: resolvedStr,
+				expectedAddress: chain.targetAddress,
+				brokenAt: isValid ? void 0 : chain.links.length - 1
+			};
+		} finally {
+			this.provider.closeProcess(handle);
+		}
+	}
+	/**
+	* Validate multiple chains in batch.
+	*/
+	async validateChains(pid, chains) {
+		const results = [];
+		for (const chain of chains) results.push(await this.validateChain(pid, chain));
+		return results;
+	}
+	/**
+	* Resolve a pointer chain to its current target address.
+	*/
+	async resolveChain(pid, chain) {
+		const handle = this.provider.openProcess(pid, false);
+		try {
+			let currentAddr = parseAddress(chain.baseAddress);
+			for (const link of chain.links) {
+				let ptrValue;
+				try {
+					ptrValue = this.provider.readMemory(handle, currentAddr, 8).data.readBigUInt64LE(0);
+				} catch {
+					return null;
+				}
+				currentAddr = ptrValue + BigInt(link.offset);
+			}
+			return formatAddress(currentAddr);
+		} finally {
+			this.provider.closeProcess(handle);
+		}
+	}
+	/**
+	* Export chains to JSON for persistence.
+	*/
+	exportChains(chains) {
+		return JSON.stringify(chains, null, 2);
+	}
+	/**
+	* Import chains from JSON.
+	*/
+	importChains(data) {
+		const parsed = JSON.parse(data);
+		if (!Array.isArray(parsed)) throw new Error("Invalid chain data: expected array");
+		return parsed;
+	}
+	/**
+	* Get module info map for resolving module-relative addresses.
+	*/
+	async getModuleMap(pid) {
+		const modules = /* @__PURE__ */ new Map();
+		try {
+			const result = await nativeMemoryManager.enumerateModules(pid);
+			if (result.success && result.modules) for (const mod of result.modules) {
+				const base = parseAddress(mod.baseAddress);
+				modules.set(mod.name.toLowerCase(), {
+					name: mod.name,
+					base,
+					size: mod.size
+				});
+			}
+		} catch {}
+		return modules;
+	}
+	/**
+	* Resolve an address to module+offset notation.
+	*/
+	resolveToModule(address, moduleMap) {
+		for (const entry of moduleMap.values()) if (address >= entry.base && address < entry.base + BigInt(entry.size)) return {
+			module: entry.name,
+			offset: Number(address - entry.base)
+		};
+		return null;
+	}
+	/**
+	* BFS scan for one level: find all addresses whose pointer-sized value
+	* points within ±maxOffset of any target address.
+	*/
+	scanLevel(handle, targetAddresses, maxOffset, alignment, _filter) {
+		const matches = [];
+		const chunkSize = POINTER_CHAIN_SCAN_CHUNK_SIZE;
+		const targets = Array.from(targetAddresses).toSorted((a, b) => a < b ? -1 : a > b ? 1 : 0);
+		if (targets.length === 0) return matches;
+		const maxOffsetBig = BigInt(maxOffset);
+		const globalMin = targets[0] - maxOffsetBig;
+		const globalMax = targets[targets.length - 1] + maxOffsetBig;
+		let address = 0n;
+		const maxAddress = BigInt("0x7FFFFFFF0000");
+		while (address < maxAddress) {
+			const regionInfo = this.provider.queryRegion(handle, address);
+			if (!regionInfo) break;
+			const regionSize = regionInfo.size;
+			if (regionInfo.isReadable && regionSize > 0 && regionSize <= Number.MAX_SAFE_INTEGER) {
+				const regionBase = regionInfo.baseAddress;
+				for (let offset = 0; offset < regionSize && matches.length < 1e5; offset += chunkSize) {
+					const readSize = Math.min(chunkSize, regionSize - offset);
+					const chunkAddr = regionBase + BigInt(offset);
+					let chunk;
+					try {
+						chunk = this.provider.readMemory(handle, chunkAddr, readSize).data;
+					} catch {
+						break;
+					}
+					for (let i = 0; i <= chunk.length - 8; i += alignment) {
+						const ptrValue = chunk.readBigUInt64LE(i);
+						if (ptrValue < globalMin || ptrValue > globalMax) continue;
+						const searchMin = ptrValue - maxOffsetBig;
+						const searchMax = ptrValue + maxOffsetBig;
+						let lo = 0;
+						let hi = targets.length;
+						while (lo < hi) {
+							const mid = lo + hi >>> 1;
+							if (targets[mid] < searchMin) lo = mid + 1;
+							else hi = mid;
+						}
+						for (let t = lo; t < targets.length && targets[t] <= searchMax; t++) {
+							const target = targets[t];
+							if ((ptrValue > target ? Number(ptrValue - target) : Number(target - ptrValue)) <= maxOffset) {
+								const pointerAddr = chunkAddr + BigInt(i);
+								const matchOffset = Number(target - ptrValue);
+								matches.push({
+									pointerAddress: pointerAddr,
+									pointsTo: ptrValue,
+									offset: matchOffset
+								});
+								break;
+							}
+						}
+					}
+				}
+			}
+			address = regionInfo.baseAddress + BigInt(regionInfo.size);
+		}
+		return matches;
+	}
+	/**
+	* Build pointer chains from level results (backward: deepest level = base).
+	*/
+	buildChains(levelResults, targetAddr, modules, maxResults, staticOnly) {
+		if (levelResults.length === 0) return [];
+		const chains = [];
+		const targetAddrStr = formatAddress(targetAddr);
+		for (let depth = 0; depth < levelResults.length && chains.length < maxResults; depth++) {
+			const level = levelResults[depth];
+			if (depth === 0) for (const match of level) {
+				if (chains.length >= maxResults) break;
+				const baseAddrStr = formatAddress(match.pointerAddress);
+				const modInfo = this.resolveToModule(match.pointerAddress, modules);
+				const isStatic = modInfo !== null;
+				if (staticOnly && !isStatic) continue;
+				const link = {
+					address: baseAddrStr,
+					module: modInfo?.module,
+					moduleOffset: modInfo?.offset,
+					offset: match.offset
+				};
+				chains.push({
+					id: randomUUID(),
+					links: [link],
+					targetAddress: targetAddrStr,
+					baseAddress: baseAddrStr,
+					isStatic,
+					depth: 1,
+					lastValidated: Date.now(),
+					isValid: true
+				});
+			}
+			else {
+				const prevLevel = levelResults[depth - 1];
+				const prevByAddr = /* @__PURE__ */ new Map();
+				for (const pm of prevLevel) prevByAddr.set(pm.pointerAddress, pm);
+				const maxOff = BigInt(POINTER_CHAIN_MAX_OFFSET);
+				for (const match of level) {
+					if (chains.length >= maxResults) break;
+					let prevMatch;
+					prevMatch = prevByAddr.get(match.pointsTo);
+					if (!prevMatch) {
+						for (const pm of prevLevel) if ((match.pointsTo > pm.pointerAddress ? match.pointsTo - pm.pointerAddress : pm.pointerAddress - match.pointsTo) <= maxOff) {
+							prevMatch = pm;
+							break;
+						}
+					}
+					if (!prevMatch) continue;
+					const baseAddrStr = formatAddress(match.pointerAddress);
+					const modInfo = this.resolveToModule(match.pointerAddress, modules);
+					const isStatic = modInfo !== null;
+					if (staticOnly && !isStatic) continue;
+					const links = [{
+						address: baseAddrStr,
+						module: modInfo?.module,
+						moduleOffset: modInfo?.offset,
+						offset: Number(prevMatch.pointerAddress - match.pointsTo)
+					}, {
+						address: formatAddress(prevMatch.pointerAddress),
+						offset: prevMatch.offset
+					}];
+					chains.push({
+						id: randomUUID(),
+						links,
+						targetAddress: targetAddrStr,
+						baseAddress: baseAddrStr,
+						isStatic,
+						depth: links.length,
+						lastValidated: Date.now(),
+						isValid: true
+					});
+				}
+			}
+		}
+		chains.sort((a, b) => {
+			if (a.isStatic !== b.isStatic) return a.isStatic ? -1 : 1;
+			return a.depth - b.depth;
+		});
+		return chains.slice(0, maxResults);
+	}
+};
+const pointerChainEngine = new PointerChainEngine();
+//#endregion
+export { PointerChainEngine, pointerChainEngine };